🚨 [security] [php] Update phpunit/phpunit 11.5.24 → 13.1.6 (major)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ phpunit/phpunit (11.5.24 → 13.1.6) · Repo

Security Advisories 🚨

🚨 PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

Impact

PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.

An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process.

Sources of INI values that participate in the attack:

• <ini name="…" value="…"/> entries in phpunit.xml / phpunit.xml.dist
• INI settings inherited from the host PHP runtime via ini_get_all()

Threat Model

Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's phpunit.xml, the host php.ini, or the PHP binary's environment. The most realistic exposure is Poisoned Pipeline Execution (PPE): a pull request from an untrusted contributor that modifies phpunit.xml to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.

Affected component

PHPUnit\Util\PHP\JobRunner::settingsToParameters().

Patches

The fix has two parts:

1. Reject line-break characters

Because a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing \n or \r is now rejected with an explicit PhpProcessException. This follows the same "visibility over silence" principle applied in CVE-2026-24765: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.

2. Quote remaining metacharacters

Values containing " or ;, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's datadog.appsec.obfuscation_parameter_value_regexp), are wrapped in double quotes with inner " escaped as \", so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (On/Off) and bitwise expressions (E_ALL & ~E_NOTICE) retain their INI semantics.

Workarounds

If upgrading is not immediately possible:

• Audit INI values: Ensure no <ini value="…"> entry in phpunit.xml / phpunit.xml.dist contains newline, ", or ; characters, and that nothing writes such values into configuration at build time.
• Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (pull_request_target and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.
• Restrict who can modify phpunit.xml: Treat phpunit.xml as security-sensitive in code review, particularly <ini> entries.
• Sanitize host INI: Ensure the host PHP's php.ini does not contain values with embedded newlines or unescaped metacharacters.

References

• Fix: #6592
• Related advisory (same threat class, Poisoned Pipeline Execution): GHSA-vvj3-c3rp-c85p / CVE-2026-24765
• OWASP CI/CD Top 10: CICD-SEC-04 Poisoned Pipeline Execution
• CWE-88: https://cwe.mitre.org/data/definitions/88.html
• CWE-93: https://cwe.mitre.org/data/definitions/93.html

🚨 PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

Impact

PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.

An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process.

Sources of INI values that participate in the attack:

• <ini name="…" value="…"/> entries in phpunit.xml / phpunit.xml.dist
• INI settings inherited from the host PHP runtime via ini_get_all()

Threat Model

Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's phpunit.xml, the host php.ini, or the PHP binary's environment. The most realistic exposure is Poisoned Pipeline Execution (PPE): a pull request from an untrusted contributor that modifies phpunit.xml to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.

Affected component

PHPUnit\Util\PHP\JobRunner::settingsToParameters().

Patches

The fix has two parts:

1. Reject line-break characters

Because a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing \n or \r is now rejected with an explicit PhpProcessException. This follows the same "visibility over silence" principle applied in CVE-2026-24765: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.

2. Quote remaining metacharacters

Values containing " or ;, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's datadog.appsec.obfuscation_parameter_value_regexp), are wrapped in double quotes with inner " escaped as \", so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (On/Off) and bitwise expressions (E_ALL & ~E_NOTICE) retain their INI semantics.

Workarounds

If upgrading is not immediately possible:

• Audit INI values: Ensure no <ini value="…"> entry in phpunit.xml / phpunit.xml.dist contains newline, ", or ; characters, and that nothing writes such values into configuration at build time.
• Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (pull_request_target and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.
• Restrict who can modify phpunit.xml: Treat phpunit.xml as security-sensitive in code review, particularly <ini> entries.
• Sanitize host INI: Ensure the host PHP's php.ini does not contain values with embedded newlines or unescaped metacharacters.

References

• Fix: #6592
• Related advisory (same threat class, Poisoned Pipeline Execution): GHSA-vvj3-c3rp-c85p / CVE-2026-24765
• OWASP CI/CD Top 10: CICD-SEC-04 Poisoned Pipeline Execution
• CWE-88: https://cwe.mitre.org/data/definitions/88.html
• CWE-93: https://cwe.mitre.org/data/definitions/93.html

🚨 PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

• CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
• Local Development Environment: An attacker with shell access or ability to write files to the project directory
• Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
   • A malicious actor placed it intentionally
   • Build artifacts from a previous run contaminated the environment
   • An unexpected filesystem state requiring investigation
3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
   • Isolate CI/CD runners (ephemeral, containerized environments)
   • Restrict code execution on protected branches
   • Scan pull requests and artifacts for tampering
   • Use branch protection rules to prevent unreviewed code execution

Severity Classification

• Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
• Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
• Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
• User Interaction (UI): None (N) — automatic execution during standard test execution
• Scope (S): Unchanged (U) — impact remains within the affected test execution context
• Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
• Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
• Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

• Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
• Code Review Enforcement: Require human review and approval before executing code from pull requests
• Branch Protection: Enforce branch protection rules that block unreviewed code execution
• Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
• Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

• Visibility: The error appears prominently in CI/CD output and test logs
• Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
• Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

• Pull requests from forks or untrusted sources execute in isolated environments
• Branch protection rules require human review before code execution
• CI/CD runners are ephemeral and discarded after each build
• Build artifacts are not reused across independent runs without validation

🚨 PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage() method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious .coverage files are present prior to the execution of the PHPT test.

Technical Details

Affected Component: PHPT test runner, method cleanupForCoverage()
Affected Versions: <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

Vulnerable Code Pattern

if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @unserialize($buffer);
}

The vulnerability occurs when a .coverage file, which should not exist before test execution, is deserialized without the allowed_classes parameter restriction. An attacker with local file write access can place a malicious serialized object with a __wakeup() method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

Attack Prerequisites and Constraints

This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

• CI/CD Pipeline Attacks: A malicious pull request that places a .coverage file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
• Local Development Environment: An attacker with shell access or ability to write files to the project directory
• Compromised Dependencies: A supply chain attack inserting malicious files into a package or monorepo

Critical Context: Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of Poisoned Pipeline Execution (PPE) attacks affecting CI/CD systems.

Proposed Remediation Approach

Rather than just silently sanitizing the input via ['allowed_classes' => false], the maintainer has chosen to make the anomalous state explicit by treating pre-existing .coverage files for PHPT tests as an error condition.

Rationale for Error-Based Approach:

1. Visibility Over Silence: When an invariant is violated (a .coverage file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
2. Operational Security: A .coverage file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
   • A malicious actor placed it intentionally
   • Build artifacts from a previous run contaminated the environment
   • An unexpected filesystem state requiring investigation
3. Defense-in-Depth Principle: Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
   • Isolate CI/CD runners (ephemeral, containerized environments)
   • Restrict code execution on protected branches
   • Scan pull requests and artifacts for tampering
   • Use branch protection rules to prevent unreviewed code execution

Severity Classification

• Attack Vector (AV): Local (L) — requires write access to the file system where tests execute
• Attack Complexity (AC): Low (L) — exploitation is straightforward once the malicious file is placed
• Privileges Required (PR): Low (L) — PR submitter status or contributor role provides sufficient access
• User Interaction (UI): None (N) — automatic execution during standard test execution
• Scope (S): Unchanged (U) — impact remains within the affected test execution context
• Confidentiality Impact (C): High (H) — full remote code execution enables complete system compromise
• Integrity Impact (I): High (H) — arbitrary code execution allows malicious modifications
• Availability Impact (A): High (H) — full code execution permits denial-of-service actions

Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

• Ephemeral Runners: Use containerized, single-use CI/CD runners that discard filesystem state between runs
• Code Review Enforcement: Require human review and approval before executing code from pull requests
• Branch Protection: Enforce branch protection rules that block unreviewed code execution
• Artifact Isolation: Separate build artifacts from source; never reuse artifacts across independent builds
• Access Control: Limit file write permissions in CI environments to authenticated, trusted actors

Fixed Behaviour

When a .coverage file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

• Visibility: The error appears prominently in CI/CD output and test logs
• Investigation: Operations teams can investigate the root cause (potential tampering, environment contamination)
• Fail-Fast Semantics: Test execution stops rather than proceeding with an unexpected state

Recommendation

Update to the patched version immediately if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

• Pull requests from forks or untrusted sources execute in isolated environments
• Branch protection rules require human review before code execution
• CI/CD runners are ephemeral and discarded after each build
• Build artifacts are not reused across independent runs without validation

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ nunomaduro/collision (8.8.1 → 8.9.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ filp/whoops (indirect, 2.18.3 → 2.18.4) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ myclabs/deep-copy (indirect, 1.13.1 → 1.13.4) · Repo

Release Notes

1.13.4

More info than we can show here.

1.13.3

More info than we can show here.

1.13.2

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nikic/php-parser (indirect, 5.6.1 → 5.7.0) · Repo · Changelog

Release Notes

5.7.0

More info than we can show here.

5.6.2

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nunomaduro/termwind (indirect, 2.3.1 → 2.4.0) · Repo · Changelog

Release Notes

2.4.0

More info than we can show here.

2.3.3

More info than we can show here.

2.3.2

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ phpunit/php-code-coverage (indirect, 11.0.10 → 14.1.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ phpunit/php-file-iterator (indirect, 5.1.0 → 7.0.0) · Repo · Changelog

Release Notes

7.0.0

More info than we can show here.

6.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ phpunit/php-invoker (indirect, 5.0.1 → 7.0.0) · Repo · Changelog

Release Notes

7.0.0

More info than we can show here.

6.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ phpunit/php-text-template (indirect, 4.0.1 → 6.0.0) · Repo · Changelog

Release Notes

6.0.0

More info than we can show here.

5.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ phpunit/php-timer (indirect, 7.0.1 → 9.0.0) · Repo · Changelog

Release Notes

9.0.0

More info than we can show here.

8.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/cli-parser (indirect, 3.0.2 → 5.0.0) · Repo · Changelog

Release Notes

5.0.0

More info than we can show here.

4.2.0

More info than we can show here.

4.1.0

More info than we can show here.

4.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/comparator (indirect, 6.3.1 → 8.1.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/complexity (indirect, 4.0.1 → 6.0.0) · Repo · Changelog

Release Notes

6.0.0

More info than we can show here.

5.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/diff (indirect, 6.0.2 → 8.1.0) · Repo · Changelog

Release Notes

8.1.0

More info than we can show here.

8.0.0

More info than we can show here.

7.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/environment (indirect, 7.2.1 → 9.3.0) · Repo · Changelog

Release Notes

9.3.0

More info than we can show here.

9.2.0

More info than we can show here.

9.1.0

More info than we can show here.

9.0.1

More info than we can show here.

9.0.0

More info than we can show here.

8.1.0

More info than we can show here.

8.0.4

More info than we can show here.

8.0.3

More info than we can show here.

8.0.1

More info than we can show here.

8.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/exporter (indirect, 6.3.0 → 8.0.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/global-state (indirect, 7.0.2 → 9.0.0) · Repo · Changelog

Release Notes

9.0.0

More info than we can show here.

8.0.2

More info than we can show here.

8.0.1

More info than we can show here.

8.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/lines-of-code (indirect, 3.0.1 → 5.0.0) · Repo · Changelog

Release Notes

5.0.0

More info than we can show here.

4.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/object-enumerator (indirect, 6.0.1 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

More info than we can show here.

7.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/object-reflector (indirect, 4.0.1 → 6.0.0) · Repo · Changelog

Release Notes

6.0.0

More info than we can show here.

5.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/recursion-context (indirect, 6.0.2 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

More info than we can show here.

7.0.1

More info than we can show here.

7.0.0

More info than we can show here.

6.0.3

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/type (indirect, 5.1.2 → 7.0.0) · Repo · Changelog

Release Notes

7.0.0

More info than we can show here.

6.0.3

More info than we can show here.

6.0.2

More info than we can show here.

6.0.1

More info than we can show here.

6.0.0

More info than we can show here.

5.1.3

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sebastian/version (indirect, 5.0.2 → 7.0.0) · Repo · Changelog

Release Notes

7.0.0

More info than we can show here.

6.0.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ symfony/console (indirect, 7.3.4 → 7.4.8) · Repo · Changelog

Release Notes

7.4.8

More info than we can show here.

7.4.7

More info than we can show here.

7.4.6

More info than we can show here.

7.4.4

More info than we can show here.

7.4.3

More info than we can show here.

7.4.1

More info than we can show here.

7.4.0

More info than we can show here.

7.3.10

More info than we can show here.

7.3.9

More info than we can show here.

7.3.8

More info than we can show here.

7.3.6

More info than we can show here.

7.3.5

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ theseer/tokenizer (indirect, 1.2.3 → 2.0.1) · Repo · Changelog

Release Notes

2.0.1

More info than we can show here.

2.0.0

More info than we can show here.

1.3.1

More info than we can show here.

1.3.0

More info than we can show here.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 sebastian/git-state (added, 1.0.0)

🗑️ sebastian/code-unit (removed)

🗑️ sebastian/code-unit-reverse-lookup (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)